Least Privilege

When a human reviews an AI agent’s commands before they run, they miss roughly one in three threats. That is the headline finding of a study of more than 40,000 sessions and 409,000 individual approve-or-deny decisions, where players reviewed an AI coding agent’s shell commands under time pressure and achieved a mean accuracy of just 66.3%. The result is not a verdict on human competence — it is a verdict on a design pattern. Sustained vigilance is something humans are measurably bad at, and any security model that depends on it as the sole safeguard is built to fail. The fix is not better humans; it is better systems that layer sandboxing, scoped credentials, and surgical gating on top of human review. ...

Secure AI agents with least privilege by giving each agent a scoped identity, limiting tools and data, enforcing policy outside the prompt, using short-lived credentials, requiring approvals for high-impact actions, sandboxing execution, and logging every tool call for continuous permission review. Why does least privilege matter more for AI agents in 2026? Least privilege for AI agents is the practice of giving an autonomous workflow only the identity, data, tools, network access, memory, and approval rights it needs for a specific task. Gartner predicts that by 2028, 33% of enterprise software applications will include agentic AI, up from less than 1% in 2024, so the blast radius of one over-permissioned agent is becoming a mainstream production risk. Traditional apps usually execute known code paths. Agents choose tools, summarize context, recover from failed calls, and may act on untrusted instructions hidden in emails, tickets, pages, or documents. That flexibility is useful, but it turns every tool call into an authorization decision. The goal is not to make prompts perfect. The goal is to make a malicious or mistaken prompt unable to read secrets, mutate production data, approve payments, or exfiltrate broad datasets. The takeaway: secure AI agents least privilege starts with limiting what the agent can actually do. ...